This is crazy because it's a flatpak, which should be a blob with all its deps in there, like a statically linked application "but better" for other system reas

This is crazy because it's a flatpak, which should be a blob with all its deps in there, like a statically linked application "but better" for other system reasons because e.g. you can sandbox the app by design. For this reason I don't understand why did they changed the library in there (that build of OBS wasn't broken because of system-wide libs, it was because allegedly they changed the lib in the flatpak), whatever the security hole couldn't they block it "from the outside"?